diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fccfed1b98eb..e04546497dec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16722,12 +16722,6 @@
     githubId = 16974598;
     name = "Mike Playle";
   };
-  mkazulak = {
-    email = "kazulakm@gmail.com";
-    github = "mulderr";
-    githubId = 5698461;
-    name = "Maciej Kazulak";
-  };
   mkez = {
     email = "matias+nix@zwinger.fi";
     github = "mk3z";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index b44f2019a3cc..fec3cf6e25ba 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -114,6 +114,8 @@
 
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
+- `libvirt` now supports using `nftables` backend.
+
 - `services.ntpd-rs` now performs configuration validation.
 
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix
index a44ccbdba652..755c56f24d00 100644
--- a/nixos/modules/services/mail/postfix-tlspol.nix
+++ b/nixos/modules/services/mail/postfix-tlspol.nix
@@ -8,6 +8,7 @@
 let
   inherit (lib)
     hasPrefix
+    literalExpression
     mkEnableOption
     mkIf
     mkMerge
@@ -23,6 +24,8 @@ let
 in
 
 {
+  meta.maintainers = pkgs.postfix-tlspol.meta.maintainers;
+
   options.services.postfix-tlspol = {
     enable = mkEnableOption "postfix-tlspol";
 
@@ -92,7 +95,13 @@ in
           dns = {
             address = mkOption {
               type = types.str;
-              default = "127.0.0.1:53";
+              default = if config.networking.resolvconf.useLocalResolver then "127.0.0.1:53" else null;
+              defaultText = literalExpression ''
+                if config.networking.resolvconf.useLocalResolver then
+                  "127.0.0.1:53"
+                else
+                  null
+              '';
               description = ''
                 IP and port to your DNS resolver
 
diff --git a/pkgs/applications/virtualization/podman-compose/default.nix b/pkgs/applications/virtualization/podman-compose/default.nix
index fd76269479b3..5288cb5f0855 100644
--- a/pkgs/applications/virtualization/podman-compose/default.nix
+++ b/pkgs/applications/virtualization/podman-compose/default.nix
@@ -9,7 +9,7 @@
 }:
 
 buildPythonApplication rec {
-  version = "1.4.1";
+  version = "1.5.0";
   pname = "podman-compose";
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonApplication rec {
     repo = "podman-compose";
     owner = "containers";
     tag = "v${version}";
-    hash = "sha256-uTwupM1Kk/Dx95MjXhg9KLw9XiefL5j2K3hlKYHq5FM=";
+    hash = "sha256-AEnq0wsDHaCxefaEX4lB+pCAIKzN0oyaBNm7t7tK/yI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index c1c4662d25b5..c0bd948d0f33 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "341.1";
+  version = "342";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-sJ4GBsBH7FTViVYiJNR8UNv5Fdo33qGJAnZo2zRLc18=";
+    hash = "sha256-NkddZeWvMSP8pcN+eFWDm6iux3REjPP2jBwHF5CTzmU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cy/cypress/package.nix b/pkgs/by-name/cy/cypress/package.nix
index 7790f3930468..2e9daf67078a 100644
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -64,20 +64,12 @@ stdenv.mkDerivation rec {
       (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
     ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux (
-    with xorg;
-    [
-      libXScrnSaver
-      libXdamage
-      libXtst
-      libxshmfence
-      nss
-      gtk2
-      alsa-lib
-      gtk3
-      libgbm
-    ]
-  );
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    nss
+    alsa-lib
+    gtk3
+    libgbm
+  ];
 
   runtimeDependencies = lib.optional stdenv.hostPlatform.isLinux (lib.getLib udev);
 
diff --git a/pkgs/by-name/he/hexpatch/package.nix b/pkgs/by-name/he/hexpatch/package.nix
index 578f12ecfd08..924b34786ff5 100644
--- a/pkgs/by-name/he/hexpatch/package.nix
+++ b/pkgs/by-name/he/hexpatch/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexpatch";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "Etto48";
     repo = "HexPatch";
     tag = "v${version}";
-    hash = "sha256-Fkje+wyYJIeCJGUHRMQubCm/OlQAeRPKXFtCnUSzPiQ=";
+    hash = "sha256-vuxVaREquHaLG/9J8v64NSudHU4IYSjKDDKLkXURiC4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TTIZEzufOE7m0PtiKKBQjY0fNVabC3oG2b06AyhPxq0=";
+  cargoHash = "sha256-xq3UmXBR/53rfIrFccF0bXYRfg2NZ0tGunv309g5eM8=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/li/libvirt/package.nix b/pkgs/by-name/li/libvirt/package.nix
index aec61329220f..184be831452b 100644
--- a/pkgs/by-name/li/libvirt/package.nix
+++ b/pkgs/by-name/li/libvirt/package.nix
@@ -22,6 +22,7 @@
   libxslt,
   makeWrapper,
   meson,
+  nftables,
   ninja,
   openssh,
   perl,
@@ -91,6 +92,7 @@ let
       iptables
       kmod
       lvm2
+      nftables
       numactl
       numad
       openssh
diff --git a/pkgs/by-name/lu/lunatask/package.nix b/pkgs/by-name/lu/lunatask/package.nix
index a63ae4563c62..440c8047ae79 100644
--- a/pkgs/by-name/lu/lunatask/package.nix
+++ b/pkgs/by-name/lu/lunatask/package.nix
@@ -6,12 +6,12 @@
 }:
 
 let
-  version = "2.1.1";
+  version = "2.1.2";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage";
-    hash = "sha256-2ks5sqE0NuVa3fyJzKJ/466Ztq9M/RhDxHZCL8tSwo4=";
+    hash = "sha256-MjzqoLPtTspLowDO3MV0joGoYuxjybuExC1h03AayB0=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/mo/mosquitto/package.nix b/pkgs/by-name/mo/mosquitto/package.nix
index 4a1c2f6a3f17..e3ec46a0f95a 100644
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mosquitto";
-  version = "2.0.21";
+  version = "2.0.22";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "mosquitto";
     rev = "v${version}";
-    hash = "sha256-E47NqiaMk67pNgf151DMhQ4DMyLvfzrECEQtk3jASPU=";
+    hash = "sha256-PCiNxRG2AqVlS2t/u7Cqn8NbTrrYGO1OXl8zvPQRrJM=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/od/odpic/package.nix b/pkgs/by-name/od/odpic/package.nix
index 834d5c397495..1e686036d0f7 100644
--- a/pkgs/by-name/od/odpic/package.nix
+++ b/pkgs/by-name/od/odpic/package.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Oracle ODPI-C library";
     homepage = "https://oracle.github.io/odpi/";
-    maintainers = with maintainers; [ mkazulak ];
     license = licenses.asl20;
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index 70746ccc5a3b..233316aaf7e8 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oelint-adv";
-  version = "7.2.6";
+  version = "8.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-adv";
     tag = version;
-    hash = "sha256-QNTC8jO6RjHNaHVNSqAoM1xAhYc35G5A7D0yfwmd6+U=";
+    hash = "sha256-ucQGXb2dqXQhf2m8TcUPQznfwBrtK7zc6DSajF/GQxU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index 69a89a8b8319..6a9ccca72fa6 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postfix-tlspol";
-  version = "1.8.11";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${version}";
-    hash = "sha256-hQSJ0bp3ghfi5chislf2zuCrvPhhoA0jjChRdGYHcFY=";
+    hash = "sha256-OBGBjbLnyDKz/UK5th1k/gfxHjBGxyWQKgiXuuJNf8Q=";
   };
 
   vendorHash = null;
@@ -28,10 +28,14 @@ buildGoModule rec {
   };
 
   meta = {
+    changelog = "https://github.com/Zuplu/postfix-tlspol/releases/tag/${src.tag}";
     description = "Lightweight MTA-STS + DANE/TLSA resolver and TLS policy server for Postfix, prioritizing DANE.";
     homepage = "https://github.com/Zuplu/postfix-tlspol";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ valodim ];
+    maintainers = with lib.maintainers; [
+      hexa
+      valodim
+    ];
     mainProgram = "postfix-tlspol";
   };
 }
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index a71a67fbfd56..ef67f65abc49 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.137";
+  version = "0.3.138";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-7sCwnUhCLfA/MACseZUT6IWR5+JjxKUyBfLSGwno/qQ=";
+    hash = "sha256-qGbLT46NFMXLJncC4ZSkjo2oDISDTsAWVvevwHTaASU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IoFJPRW4SXAWxfBKNBrgtxBAYfbRwxuN9Aig3P9QkOk=";
+  cargoHash = "sha256-lMtZQNC3hix65Y1s5LqNdpY8u0TnJvnrhTm64lql4R8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 74320b74435a..a52644c2413d 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -41,7 +41,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "25.05.0.1";
+  version = "25.05.1.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-C1euW/twT3AhwtNUmUDtmFjMUi5B4I7r488YcT+N/zM=";
+    hash = "sha256-Lu/ebXI8U4XggYhQ+yyKmGXpgqtCeYMWB3o0+Ujzj0s=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/tt/ttop/package.nix b/pkgs/by-name/tt/ttop/package.nix
index 549ba705b98f..da6e502135e3 100644
--- a/pkgs/by-name/tt/ttop/package.nix
+++ b/pkgs/by-name/tt/ttop/package.nix
@@ -7,13 +7,13 @@
 
 buildNimPackage (finalAttrs: {
   pname = "ttop";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "inv2004";
     repo = "ttop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KfPlO0RmahavA3dsxNDozuNOXIRAwDTtT+zFaF6hYd0=";
+    hash = "sha256-e3c7ovFxQN/pJ18Qg8+DdLqfhgmrHSTNM5zDZ2Jaapw=";
   };
 
   lockFile = ./lock.json;
diff --git a/pkgs/by-name/wh/whisper-ctranslate2/package.nix b/pkgs/by-name/wh/whisper-ctranslate2/package.nix
index b950edf4b202..fa3d1b093b0b 100644
--- a/pkgs/by-name/wh/whisper-ctranslate2/package.nix
+++ b/pkgs/by-name/wh/whisper-ctranslate2/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   python3,
   python3Packages,
   fetchFromGitHub,
@@ -41,6 +42,9 @@ python3Packages.buildPythonApplication {
     ${python3.interpreter} -m nose2 -s tests
     runHook postCheck
   '';
+  # Tests fail in build sandbox on aarch64-linux, but the program still works at
+  # runtime. See https://github.com/microsoft/onnxruntime/issues/10038.
+  doCheck = with stdenv.buildPlatform; !(isAarch && isLinux);
 
   passthru.updateScript = nix-update-script { };
 
@@ -51,10 +55,5 @@ python3Packages.buildPythonApplication {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ happysalada ];
     mainProgram = "whisper-ctranslate2";
-    badPlatforms = [
-      # terminate called after throwing an instance of 'onnxruntime::OnnxRuntimeException'
-      #   what():  /build/source/include/onnxruntime/core/common/logging/logging.h:320 static const onnxruntime::logging::Logger& onnxruntime::logging::LoggingManager::DefaultLogger() Attempt to use DefaultLogger but none has been registered.
-      "aarch64-linux"
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 9eeb2a4e10be..f78b5f2b15f2 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.8.4";
+  version = "1.8.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-PZamAF6LaBgSlLNkaKRFHnibmcnplCShQXa2DwvObjc=";
+    hash = "sha256-Osjpt/oxw5LAVUvhPg2cICSeKaLrOdppNT0jqHz9HyA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mdformat-mkdocs/default.nix b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
index 6b18d7b60941..e30c40acb41a 100644
--- a/pkgs/development/python-modules/mdformat-mkdocs/default.nix
+++ b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
@@ -3,13 +3,18 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  mdformat,
+  mdformat-beautysh,
+  mdformat-footnote,
+  mdformat-frontmatter,
   mdformat-gfm,
+  mdformat-simple-breaks,
+  mdformat-tables,
+  mdformat,
   mdit-py-plugins,
   more-itertools,
-  pythonOlder,
   pytest-snapshot,
   pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -35,6 +40,20 @@ buildPythonPackage rec {
     more-itertools
   ];
 
+  optional-dependencies = {
+    recommended = [
+      mdformat-beautysh
+      # mdformat-config
+      mdformat-footnote
+      mdformat-frontmatter
+      # mdformat-ruff
+      mdformat-simple-breaks
+      mdformat-tables
+      # mdformat-web
+      # mdformat-wikilink
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-snapshot
     pytestCheckHook
diff --git a/pkgs/development/python-modules/mdformat/default.nix b/pkgs/development/python-modules/mdformat/default.nix
index 393d877370c2..c9c3040424d9 100644
--- a/pkgs/development/python-modules/mdformat/default.nix
+++ b/pkgs/development/python-modules/mdformat/default.nix
@@ -2,12 +2,10 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  importlib-metadata,
   markdown-it-py,
   pytestCheckHook,
   pythonOlder,
   setuptools,
-  tomli,
 }:
 
 buildPythonPackage rec {
@@ -15,7 +13,7 @@ buildPythonPackage rec {
   version = "0.7.22";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
@@ -26,10 +24,7 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  dependencies =
-    [ markdown-it-py ]
-    ++ lib.optionals (pythonOlder "3.11") [ tomli ]
-    ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];
+  dependencies = [ markdown-it-py ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 5670963b1091..cc481b7b85f6 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -103,6 +103,7 @@ lib.makeExtensible (self: {
   xcode_16_1 = requireXcode "16.1" "sha256-yYg6NRRnYM/5X3hhVMfcXcdoiOV36fIongJNQ5nviD8=";
   xcode_16_2 = requireXcode "16.2" "sha256-wQjNuFZu/cN82mEEQbC1MaQt39jLLDsntsbnDidJFEs=";
   xcode_16_3 = requireXcode "16.3" "sha256-hkIlRYUc1SD2lBwhRtqBGJapUIa+tdOyPKG19Su5OUU=";
+  xcode_16_4 = requireXcode "16.4" "sha256-voCEZlKrp9NYGmXAsf1FHxO69EgWZHDIWtQZ2qEzElA=";
   xcode =
     self."xcode_${
       lib.replaceStrings [ "." ] [ "_" ] (
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b378ae9b068e..29eb4bfe72b0 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -170,6 +170,7 @@ makeScopeWithSplicing' {
         xcode_16_1
         xcode_16_2
         xcode_16_3
+        xcode_16_4
         xcode
         requireXcode
         ;